The work itself · Article 3 of 3
Nothing leaves the tools it lives in
How we gave AI working memory over a firm’s knowledge without indexing a single document: live federated search, read-only scopes, and answers that cite their sources.
1 · The question underneath the demo
Every professional firm is now being shown the same demonstration: an assistant that answers questions about your own business. Where is the latest agreement with this client. What did we tell them in March. Who is waiting on us.
It is a good demonstration, because the need behind it is real. A firm’s knowledge is scattered across mail, files, tasks, and calendars, and the people who can navigate all four from memory are the least replaceable people in the building.
The question underneath the demonstration is architectural, and it is the one to ask before any pilot. To answer from our knowledge, what does the system do with our knowledge?
For most products the answer is an index. Your mail, files, and records get copied, parsed, and stored in the vendor’s search infrastructure, where the assistant can reach them quickly. That copy is what makes the demonstration fast. It is also a second corpus of everything confidential your firm holds, living outside the systems you actually govern, and for a reputation-first firm that ought to stop the conversation until somebody has examined it properly.
This article describes the alternative we run ourselves. No index, no copy, live search at question time, in the tools where the knowledge already lives.
2 · Two architectures, one decision
The index pattern has real virtues, speed above all, and at enterprise scale it can be governed with serious engineering behind it. Its costs are structural rather than incidental, though, and they come in three kinds.
The copy is a new attack surface holding everything at once, so a single compromise reaches the whole firm’s history rather than one mailbox. The copy goes stale between crawls, so the assistant answers from last Tuesday with total confidence. And the copy has to reimplement permissions: the mail only two partners can see, the folder shared with one client, all of it mirrored into the index’s own access model, and wrong the moment somebody changes a sharing setting upstream. Permission drift in a search index is how an associate learns that the acquisition is happening.
The federated pattern accepts a latency cost in order to make those problems not exist. Nothing is copied anywhere. A question triggers live queries against each system’s own interface, mail search and file search and task queries and calendar reads, under an identity the firm controls, at the moment of asking.
Each system then enforces its own permissions, the same way it does when a person searches it, so what the assistant can see is exactly what its identity can see and there is no mirror to drift. Answers get assembled from what came back, with citations, so every claim carries a link to the message or document or task it came from and trust in the answer never has to be trust in the assistant. And revocation is one click in one admin screen, because there is no copy to chase down.
3 · We run this ourselves, daily
This is not a whitepaper pattern for us. It is how our own firm answers questions.
Ask our assistant what was last sent to a given client and whether they replied, and it searches the actual mailbox, live, reads the actual thread, and answers with the thread cited rather than from a stored summary. Ask for the status of a proposal and it checks the document, the sending email, and the task system, then reconciles the three.
Running it daily taught us two disciplines that make federated search work in practice, and both are portable to any firm.
First, a verified map of where facts live. Live search across four systems is only as good as its routing. Client commitments live in mail. Work state lives in the task system, from the date we adopted it and not before. Current documents live in named folders under naming conventions that parse. We maintain that map as an artifact, checked against the live systems and updated when reality drifts away from it. Most firms hold this knowledge in people’s heads, and writing it down is the larger part of making a firm searchable at all. It pays for itself well before any AI touches it.
Second, precedence rules for when sources disagree, because they disagree constantly. Ours are written down and blunt. What was actually sent to the client outranks every internal copy. A document’s contents outrank its filename, so a file marked final that says draft inside is a draft. The task system is truth for what is open and who owns it. Newer beats older within a single source. When the assistant reconciles a conflict it says which rule decided, and the alternative, an assistant that silently picks a source, is how confident wrong answers get institutionalized.
One more property matters to us and will matter to any partnership. The assistant sees with the asker’s own eyes. Each principal runs it under his own accounts, so it reads for me exactly what I can read and for my partner exactly what he can. There is no super-identity holding everything, because a super-identity is the index problem wearing a lanyard.
4 · Extending it to client systems
The pattern’s sharpest test is the one our client work poses. Sometimes serving a client well requires our tooling to read parts of their estate, their document libraries, their process records.
The index answer would be to pull a copy of the relevant corpus into our systems, and that is exactly what we refuse to do, because every property that made indexes dangerous at home is worse across a trust boundary.
What we bring instead is a dedicated application identity in the client’s own tenant, granted read-only scopes, and narrow ones: the specific libraries and mailboxes in scope rather than the tenant. Modern platforms make this precise. Microsoft’s cloud, for instance, lets an application be limited to named sites and given read access without write, so the grant reads like a sentence a general counsel can approve in a meeting. Everything the identity does is logged in the client’s own audit trail, in their tenancy, visible to their administrators. Nothing synchronizes outward. Queries run at question time, results are used and released.
And the whole arrangement is revocable by the client, unilaterally, in one screen. That is the property we lead with when we propose it, because the off switch is theirs. It always is.
That last sentence is the entire philosophy, and it echoes every article in this library. Stage independence said engagements should be built so that clients can stop. The same principle, applied to data access, says integrations should be built so that clients can revoke. Dependence and trust are opposites, in contracts and in scopes alike.
5 · The questions to ask any knowledge-assistant vendor
Portable, as usual, and we are happy to be asked them ourselves.
- Where does our content physically go when the assistant reads it, and does any copy persist after the answer?
- Who enforces permissions at answer time: your mirror of our permissions, or our systems themselves?
- Can every answer cite its sources, down to the message and the document, so our people can verify rather than trust?
- What exactly is in the grant, which scopes, read or write, which stores, and can we read the whole grant in one screen?
- What is revocation here, a contract clause and a deletion request, or a switch we control?
There are honest index-based answers to some of those at some scales, and a vendor who engages seriously with the questions is worth hearing out. But for firms our clients’ size, whose reputation is the product and whose IT capacity is finite, we keep reaching the conclusion we built for ourselves. The safest copy of your knowledge is the one that was never made.
Nothing leaves the tools it lives in, and everything the assistant says about your own business arrives with a receipt.
That closes the series on the work itself. What remains is the receipts: how these pages were made, and the test underneath every AI question a firm will ever be asked.